Is using a US-based AI tool a transfer of personal data?

Often, yes. The EDPB treats it as a transfer when three things are all true: you are subject to the GDPR for that processing, you send or make personal data available to another controller or processor, and that recipient is in a country outside the EEA (EDPB Guidelines 05/2021, version 2.0). Making data available can include remote access from outside the EEA, for example by a supplier's support team.

Can we rely on the EU-US Data Privacy Framework?

Only for US organisations that have joined it through self-certification and are on the Data Privacy Framework List, and only for the data their certification covers. The Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795) is in force. The General Court dismissed an action against it on 3 September 2025 (T-553/23, Latombe); an appeal to the Court of Justice (C-703/25 P) was pending when we checked on 21 October 2026.

What if the supplier is not on the list or is in a country without an adequacy decision?

You need another tool under Article 46, most often the Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), with a transfer impact assessment under Clause 14. The Article 49 derogations, such as explicit consent, are for specific situations and are not a general route for routine use of a tool.

Your AI tool sends customer data to the US or elsewhere outside Europe: a GDPR international transfer check sheet for small EU businesses (Chapter V)

Updated 21 Oct 2026 · Disclosure: the EURO AI Register mentioned below is an Unadhi product with a free edition. This guide is for information only, not legal advice.

What you get: a finished transfer check sheet with one row per AI tool: a "is it a transfer?" test in three questions, a tool table (supplier, where data goes, legal basis, date checked), a basis table saying exactly what to check and what proof to keep for adequacy, the EU-US Data Privacy Framework and standard contractual clauses, the privacy notice line and the records line to copy, and five questions to send the supplier.

The short answer

When personal data leaves the EEA for an AI supplier, the GDPR's transfer rules in Chapter V apply (Article 44). Each transfer needs a basis: an adequacy decision (Article 45), appropriate safeguards such as the Commission's standard contractual clauses (Article 46), or, only in specific situations, a derogation (Article 49). For US suppliers, the EU-US Data Privacy Framework counts as adequacy only if the supplier is on the official list. Tell people about transfers in your privacy notice (Article 13(1)(f)) and list them in your records (Article 30(1)(e)).

Step 1: is it a transfer? Three questions

Question	Yes / no
1. Is your business subject to the GDPR for this processing? (An EU business usually is.)	[..]
2. Do you send personal data to the AI supplier, or make it available to it, for example customer chats, emails, call recordings, CVs?	[..]
3. Is the supplier, or anyone it uses (sub-processor, support team with remote access), in a country outside the EEA?	[..]

Three yes answers mean a transfer under Chapter V (EDPB Guidelines 05/2021, version 2.0, adopted 14 February 2023). If the supplier keeps everything in an EEA data region and no one outside the EEA can access it, there may be no transfer, but you still need the normal GDPR safeguards. Under Article 44 the rules also cover onward transfers, so ask about the supplier's own AI model providers.

Step 2: the tool table

AI tool	Supplier	Where data goes	Legal basis	Checked on
Chatbot on your website	[supplier, country of HQ]	[data region in your settings; support access from where]	[adequacy / DPF / SCCs / no transfer]	[date checked]
AI writing or chat assistant used by staff	[..]	[..]	[..]	[..]
AI meeting note-taker	[..]	[..]	[..]	[..]
AI features inside your CRM or helpdesk	[..]	[..]	[..]	[..]
AI model the tool itself calls (sub-processor)	[..]	[..]	[..]	[..]

Take the facts from the supplier's data processing agreement and its published sub-processor list. A processor needs your written authorisation before adding another processor and, under a general authorisation, must tell you about changes so you can object (Article 28(2)). Its contract must say it follows your documented instructions, including on transfers (Article 28(3)(a)).

Step 3: the basis table, what to check and what to keep

Basis	What to check	Proof to keep
Recipient country has an EU adequacy decision (Article 45)	Check the country is on the Commission's adequacy list (for example the United Kingdom, Switzerland, Japan, Canada for commercial organisations). For the United States, adequacy only covers organisations in the Data Privacy Framework.	Decision name and date; date checked
US supplier on the Data Privacy Framework List	Search the supplier's exact legal name on dataprivacyframework.gov. Check that its EU-U.S. DPF participation is active and that the covered data matches yours (for example HR data if staff data goes in). Listing must be renewed each year.	Screenshot or PDF of the list entry; date checked
Standard contractual clauses (Article 46(2)(c))	Usually in the supplier's data processing agreement. Module 2 for controller to processor, Module 3 for processor to sub-processor. The clauses must not be changed except as allowed.	Which module; where in the contract; signed annex I
Transfer impact assessment (SCC Clause 14)	Needed when you rely on SCCs: the circumstances of the transfer, the destination country's laws and practice, and any extra safeguards. Ask the supplier for its own assessment; you still own yours.	Supplier's document + your one-page conclusion
Derogation (Article 49)	Only for specific cases, for example explicit consent after the person is told the risks (Article 49(1)(a)). Not a basis for everyday use of an AI tool.	Why it applies; how consent was recorded

Data Privacy Framework status on 21 October 2026: the adequacy decision for the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023) is in force. On 3 September 2025 the General Court dismissed an action for its annulment (Case T-553/23, Latombe v Commission). The applicant appealed to the Court of Justice on 31 October 2025 (Case C-703/25 P); when we checked, no judgment or Advocate General opinion had been published. If the decision were ever annulled, transfers relying on it would need another basis, so note in your sheet which suppliers also offer standard contractual clauses.

Step 4: two lines to copy

Privacy notice (Article 13(1)(f)):

We use [AI tool] provided by [supplier] to [purpose]. This involves transferring your [data types] to [country]. The transfer relies on [the European Commission's adequacy decision for [country] / the EU-US Data Privacy Framework, in which [supplier] participates / the European Commission's standard contractual clauses]. You can ask us for a copy of the safeguards at [contact].

Records of processing (Article 30(1)(e)): "Transfers: [country], [supplier], basis [..], checked [date]." Add it to your Article 30 records sheet.

Step 5: five questions to send the supplier

In which countries is our data stored and processed, including backups, logs and support access?
Which sub-processors, including AI model providers, receive our data, and where are they?
What is your transfer basis for each: adequacy, Data Privacy Framework (exact legal entity listed) or standard contractual clauses (which module)?
Can you share your transfer impact assessment and the security measures in annex II?
Can we choose an EEA data region, and does that cover prompts, outputs and logs?

Do this week

Fill one row of the tool table for each AI tool your staff use
Check each US supplier on dataprivacyframework.gov and save the entry with the date
Find the standard contractual clauses in each non-adequacy supplier's contract
Update your privacy notice and records with the lines above
Put a yearly reminder to re-check the list entries

This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 13, 28, 30, 44, 45, 46 and 49), Commission Implementing Decision (EU) 2021/914 (standard contractual clauses) and Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework). See also EDPB Recommendations 01/2020 on supplementary measures (version 2.0, 18 June 2021). Checked on 21 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.

For accountants and tax advisers

Clients rarely know where their AI tools send data. At the next review, fill the tool table with them and attach it to their client AI inventory. Stay inside your professional rules and pass contract questions to a privacy professional or lawyer.

Keep the sheet next to your AI register

The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once with its supplier, and keep the transfer check as an evidence record.

When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.

Partner programme opening soon

Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Sources

← All guides

Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.